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REMARKS 

The final Office Action dated April 14, 2009 was received and carefully reviewed. 

By this response, no claims have been amended, no claims have been canceled, and no 
claims have been amended. Thus, claims 1-26 remain pending in the instant application. 

Applicant respectfully requests reconsideration and allowance of the above-identified 
application in view of the above amendments and the following remarks. 

Claim Rejections - 35 U.S.C. § 101 
Claims 1-14 and 24-26 stand rejected under 35 U.S.C. § 101 as allegedly being directed 
to non-statutory subject matter. Applicant traverses this rejection for at least the following 
reasons. 

Applicant contends that electronic data is changed using the operation method as seen in 
claims 1-14 and 24-26, and thus satisfies a transformation as defined by the present "Machine- 
or-Transformation" test as set forth under the Federal Circuit Court's decision handed down in 
the case of /« re Bilski, 545 F.3d 943. 88 U.S.P.0.2d 1385 (Fed. Cir. 2008). 

Accordingly, the subject matter of claims 1-14 and 24-26 is directed to statutory subject 
matter xmder 35 U.S.C. § 101, and thus it is requested that the rejection be withdrawn. 

Claim Rejections - 35 U.S.C. § 103 

Claims 1, 6, 8, 14, 16, 19, 21 and 23-26 stand rejected under 35 U.S.C. § 103(a) as 
allegedly being unpatentable over Tschiegg et al. (U.S. Pub. No. 2003/0160818 Al) (Tschiegg, 
hereinafter) in view of Heinrich (U.S. Pub. No. 2003/0046128 Al) {Heinrich, hereinafter). 
Claims 2-5, 7, 9-13, 15, 20 and 22 stand rejected under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over Tschiegg in view of Heinrich and in fiirther view of Lovejoy et al. (U.S. Pub. 
No. 2002/01238416 Al) {Lovejoy, hereinafter). Applicant traverses the rejections for at least 
the reasons set forth below. 

Applicant contends that present independent claims 1 and 16, and the claims dependent 
therefrom, are patently distinguishable over Tschiegg, Heinrich and Lovejoy, since Tschiegg and 
Heinrich and Lovejoy, taken either alone or in combination, fail to disclose, teach or suggest all 
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of the features recited in the pending claims. For example, independent claim 1 (emphasis 

added) recites: 

1. A computer-implemented method for assessing risk 
within an organization, comprising: 

defining one or more zones, each of said one or more 
zones comprising an environment; 

identifying one or more assets of said organization, each 
of said assets being located in a respective one of said zones; 

conducting a respective impact assessment for each of 
said assets, each assessment comprising assessing the impact 
of the loss of said respective asset; 

conducting for each of said zones a respective zone risk 
assessment, comprising assessing the risk level associated with 
placing a respective asset within said respective corresponding 
zone; 

conducting for each asset a respective asset risk 
assessment, comprising assessing the risk level associated with 
said respective asset independent of the respective zone of said 
respective asset; and 

assessing risk on the basis of at least said impact 
assessment, said zone risk assessments and said asset risk 
assessments. 

Independent claim 1 6 (emphasis added) recites: 

16. An apparatus for assessing risk within an 
organization, comprising: 

data input means for inputting asset information into a 
register of assets, each of said assets being an asset of said 
organization, each of said assets being located in a respective 
zone; 

data storage for storing said register of assets, including 
for each of said assets said respective zone; 

means for receiving or storing a respective zone risk 
assessment for each of said zones, said respective zone risk 
assessment comprising an assessment of the risk level associated 
with placing a respective asset within said respective 
corresponding zone; 

means for receiving or storing a respective asset risk 
assessment for each asset, said respective asset risk assessment 
comprising an assessment of the risk level associated with said 
respective asset independent of the respective zone of said 
respective asset; 

means for receiving or storing a respective impact 
assessment for each of said assets, each assessment comprising 
assessing the impact of the loss of said respective asset, and 
for assessing risk on the basis of at least said impact 
assessment, said zone risk assessments and said asset risk 
assessments to thereby form a risk assessment; and 
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output means for outputting said risk assessment. 
As seen above, independent claim 1 is directed to, inter alia, the features of conducting a 
respective impact assessment for each of said assets, each assessment comprising assessing the 
impact of the loss of said respective asset. As further seen above, independent claim 16 is 
directed to, inter alia, the feature of means for receiving or storing a respective impact 
assessment for each of said assets, each assessment comprising assessing the impact of the loss 
of said respective asset, and for assessing risk on the basis of at least said impact assessment, 
said zone risk assessments and said asset risk assessments to thereby form a risk assessment, as 
recited in present independent claim 16. Applicants contend that Tschiegg, Heinrich and 
Lovejoy, taken either alone or in combination, fail to disclose at least the above recited features 
with respect to present independent claims 1 and 16. 

As seen on pages 6-7 of the Office Action, the Examiner alleges that Tschiegg discloses 
the feature of "conducting a respective impact assessment for each of said assets, each assessment 
comprising assessing the impact of the loss of said respective asset", and cites paragraph [0019] if 
Tschiegg as allegedly disclosing this feature. However, paragraph [0019] of Tschiegg actually 
states: 

[0019] In certain aspects, one system of the invention 
generates one or naore of the following recommended co^- 
benefit analysis information through the graphics interface 
and over the network: total loss before implementation of a 
recommeodation, total loss after implementation of a rec- 
ommendation, property damage loss before impleTnentaiion 
of a recommendation, property damage loss after implemen- 
tation of a recommendation, business interruption loss 
before implementation of a recommendation, business inter- 
niption loss after implementation of a recommendation, 
estimated cost to aimplete, estimated cost to complete 
source, estimated probability, estimated probability source, 
and estimated annual risk avoidance. The estimated annual 
risk avoidance may for example include a factor of [(prop- 
erty loss before implementation of a recommendation+ 
business interniption loss before implementation of a rec- 
ommendation)-(property loss after implementation of a 
recommendation+business interruption loss after implemen- 
tation of a recommendation) ]/probability (in years)). 
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As seen in the above passage, Tschiegg appears to merely disclose determining loss 
before and after implementation of recommendation. In the context of the present invention, the 
feature of "conducting a respective impact assessment for each of said assets, each assessment 
comprising assessing the impact of the loss of said respective asset", which measures impact as a 
total loss of asset, is fundamentally different from the teachings in Tschiegg that determine loss 
before and after an implementation of recommendation. 

Applicant further contends that the present invention computes loss based on the potential 
worst case consequential impacts. The impact criteria of the present invention are as follows: 1) 
Loss of Opportunity, 2) Loss of Productivity, 3) Loss due to Regulatory and Contractual 
Breaches, 3) Cost of System Investment, and 4) Loss due to Confidentiality Breaches. Thus, as 
clearly seen in the list of impact criteria, there is no consideration of risk analysis 
recommendations . Consequently, the rejection the Examiner's rejection of the claims citing that 
Tschiegg discloses determining loss before and after implementation of recommendation is 
improper . 

Furthermore, Applicant asserts that neither Heinrich nor Lovejoy make up for the 
deficiencies with respect to Tschiegg. For at least the reasons stated above Tschiegg, Heinrich 
and Lovejoy, taken either alone or in combination, fail to anticipate or render obvious each and 
every feature recited in present independent claims 1 and 16. Thus, the Examiner has failed to 
provide a prima facie case of obviousness. Accordingly, Applicants respectfully request the 
withdrawal of the rejection of independent claims 1 and 16 under 35 U.S.C. § 103(a), and the 
allowance of these claims. 

Claims 2-15 and 17-26 are allowable at least by virtue of their dependency from one of 
the independent claims, but also because they are distinguishable over the prior art. 

In view of the foregoing, it is submitted that the present application is in condition for 
allowance and a notice to that effect is respectfully requested. If, however, the Examiner deems 
that any issue remains after considering this response, the Examiner is invited to contact the 
undersigned attorney/agent to expedite the prosecution and engage in a joint effort to work out a 
mutually satisfactory solution. 
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Except for issue fees payable under 37 C.F.R. § 1.18, the Commissioner is hereby 
authorized by this paper to charge any additional fees during the entire pendency of this 
application including fees due under 37 C.F.R. §§ 1.16 and 1.17 which may be required, 
including any required extension of time fees, or credit any overpayment to Deposit Account No. 
19-2380. This paragraph is intended to be a CONSTRUCTIVE PETITION FOR 
EXTENSION OF TIME in accordance with 37 C.F.R. § 1.136(a)(3). 

Respectfully submitted, 
NIXON PEABODY, LLP 



Date: October 14. 2009 /Anthony J. Canning, Reg. #62.107/ 

Anthony J. Canning 
Registration No. 62,107 

NIXON PEABODY LLP 
Customer No. 22204 

200 Page Mill Road 
2nd Floor 

Palo Alto, CA 94306-2022 

(650) 320-7782 
I (866)958-0591 
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